Working Draft — Not yet in effect. Pending attorney review before publication. Items marked [TBD] require completion.
Privacy
Privacy Policy
1. Who we are
GuruSan ("we," "us," "our") is operated by GuruSan LLC, an Alaska limited liability company. We operate the consciousness-assessment platform at gurusan.observer. We are the data controller of the personal information described in this policy. For privacy questions, contact privacy@gurusan.observer.
2. Information we collect
You provide directly
- Account information — your email address; if you use Google sign-in, your Google account identifier and basic profile (name, email).
- Questionnaire responses — your answers to the 56 assessment questions. These are personal, introspective reflections that may touch on your emotions, relationships, past experiences, and inner life. We treat them as sensitive.
We generate about you
- Assessment results — dimensional scores, overall level, archetype, and personalized text; reassessment history.
Created when you pay
- Payment records — product purchased, amount, and transaction identifiers. Payments are processed by Creem (our Merchant of Record); we do not receive or store your full card number.
Collected automatically
- Authentication and session cookies that keep you signed in (see our Cookie Policy).
- Basic technical data (IP address, device/browser type) processed by our hosting provider to deliver and secure the service. [TBD: confirm if any analytics are in use — update if added]
3. How we use your information
- To generate, store, and display your assessment.
- To create your account and keep you signed in.
- To process purchases and grant access to paid content.
- To send transactional emails and, where applicable, reassessment reminders.
- To secure, maintain, and improve the service.
- To comply with legal obligations.
Legal bases for EEA / UK users (GDPR Art. 6)
| Purpose | Data involved | Legal basis |
|---|---|---|
| Providing the assessment | Questionnaire responses, scores, archetype | Contract (Art. 6(1)(b)) |
| Account creation and authentication | Email, Google profile (if used) | Contract (Art. 6(1)(b)) |
| Payment processing | Payment records | Contract (Art. 6(1)(b)) |
| Transactional and reminder emails | Email address | Contract (Art. 6(1)(b)) |
| Service security and improvement | Technical data, logs | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | All relevant data | Legal obligation (Art. 6(1)(c)) |
| Questionnaire responses (if Art. 9 applies) | Questionnaire responses | [TBD: confirm with attorney: explicit consent (Art. 9(2)(a)) if responses qualify as special-category data] |
4. How your responses are scored — please read
To generate your assessment, your questionnaire responses are sent to Anthropic, the provider of the Claude AI model, which processes them to produce your scores and personalized text. This means your introspective answers leave our systems and are processed by a third-party AI provider for this purpose. We may also use Claude to generate personalized reassessment reminder emails based on your prior scores.
[TBD: Anthropic data-use/retention terms — confirm and document before publishing. Confirm DPA exists.]
We call this out separately because it matters: if you are not comfortable with your responses being processed by a third-party AI provider, please do not submit the questionnaire.
5. Who we share information with
We share personal information only with service providers who help us run the platform, under contract and only as needed. We have entered into (or will enter into before processing commences) Data Processing Agreements (DPAs) with each of these providers. [TBD: confirm DPAs signed with each vendor before publishing]
- Anthropic — AI scoring of questionnaire responses (see §4)
- Supabase — database, authentication, storage
- Creem — payment processing (Merchant of Record)
- Resend — transactional and reminder emails
- Vercel — application hosting and delivery
- Cloudflare — DNS
- Google — only if you use Google sign-in
We do not sell your personal information. [TBD: confirm CCPA sharing position re: Anthropic processing — see §8 California rights] We may disclose information where required by law or to protect rights and safety.
6. International transfers
Several providers are based in the United States. If you access GuruSan from outside the US, your information may be transferred to and processed there.
For users in the EEA, UK, or Switzerland, where personal data is transferred to US-based providers (Anthropic, Supabase, Creem, Resend, Vercel), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, or equivalent transfer mechanisms recognized under applicable law. [TBD: confirm SCCs or other transfer mechanism in place with each vendor before publishing]
7. How long we keep it
We retain your account, assessments, and purchase records while your account is active. When you delete your account, your assessments and reassessment schedule are deleted with it. Payment records are retained as required for tax and legal compliance. [TBD: confirm payment retention period with CPA — typically 7 years]
8. Your rights
To exercise any right described below, contact privacy@gurusan.observer. We may need to verify your identity before processing a request.
All users
- Access and receive a copy of your personal information.
- Correct inaccurate information.
- Delete your account and associated data (see §7 for retention exceptions).
- Export your data in a portable format (available from your dashboard).
- Withdraw consent where processing is based on consent.
EEA and UK users (GDPR)
If you are in the EEA, UK, or Switzerland, you have additional rights under the GDPR:
- Right of access (Art. 15) — request a copy of your personal data and information about how it is processed.
- Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17) — request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.
- Right to restriction (Art. 18) — request that we pause processing in certain circumstances (e.g., while accuracy is contested).
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interests.
- Right to lodge a complaint — you have the right to complain to your local data protection supervisory authority. [TBD: add EEA representative contact if required under Art. 27 — see B-06]
We will acknowledge your request within 10 business days and respond within 30 calendar days. Complex requests may take up to 90 days; we will notify you within the initial 30 days if an extension is needed.
California users (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights.
Categories of personal information we collect
- Identifiers (email address, user ID, Google identifier if used)
- Internet or network activity (session and technical data)
- Commercial information (purchase records, transaction identifiers)
- Inferences (assessment scores, archetype, dimensional profile derived from your responses)
- Other personal information (questionnaire responses submitted to the platform)
- Sensitive personal information (questionnaire responses may qualify as reflecting psychological characteristics — [TBD: confirm with attorney — D-03])
Your rights
- Right to know — request disclosure of the categories and specific pieces of personal information collected about you, the purposes for which it is used, and who it is shared with.
- Right to delete — request deletion of your personal information (subject to legal exceptions).
- Right to correct — request correction of inaccurate personal information.
- Right to data portability — receive your personal information in a portable, usable format.
- Right to limit use of sensitive personal information — if we collect sensitive personal information, you may request that we limit its use to what is necessary to provide the service.
- Right to non-discrimination — we will not discriminate against you for exercising any of these rights.
Do Not Sell or Share My Personal Information
GuruSan does not sell your personal information for money. We share it only with service providers under contract, as described in §5. [TBD: confirm with attorney whether Anthropic API processing constitutes CPRA 'sharing' — if so, a Do Not Sell or Share link may be required (B-04)]
To submit a California rights request, contact privacy@gurusan.observer. We will acknowledge receipt within 10 business days and respond within 45 calendar days. We may extend by an additional 45 days with notice.
9. Security
We use measures including encryption in transit (TLS), access controls, and database row-level security so that each user can access only their own data. No system is perfectly secure, and we cannot guarantee absolute security.
10. Children
GuruSan is not directed to or intended for children under 18, and we do not knowingly collect their information. If you believe a child has provided information through our service, contact privacy@gurusan.observer.
11. Changes
We may update this policy. Material changes will be reflected in the effective date and, where appropriate, by notifying you. Continued use after a change constitutes acceptance.
12. Contact
privacy@gurusan.observer · GuruSan LLC, [TBD: business address]